Why don’t we do email verification in reverse? • Hacker News Board

Re: Why don’t we do email verification in reverse?

#241

Post by gingerlime » Sun, Aug 21, 2022, 2:07 PM UTC

ozim wrote: post #104

gingerlime wrote: post #30

Besides the security and usability problems others mentioned, I also highly doubt it will improve confirmation conversions. One thing that helped us improve confirmations -- we A/B tested it and confirmation rates increased ~8%: send a 4-digit confirmation code rather than just a link. It's easier and more familiar on mobile, especially if you see the code on the push notification, so don't even need to open the emai…

Not having a link in email is important. I believe most of the times email from my systems go to spam because there is a link in it. I don't have any hard data but I can imagine that if email contains link it will be checked by more rules in heuristic checks. If there are no links - most likely it is not spam.

in our case we included both a link and the code and saw an increase in confirmation rates. If I recall we reached over 90% conversion rates. For a B2C niche service, I think that’s pretty high. I somehow doubt removing the link will improve things further, but it might be interesting to test in future.

Re: Why don’t we do email verification in reverse?

#242

Post by remram » Sun, Aug 21, 2022, 2:09 PM UTC

amelius wrote: post #174

Why do we even need email verification? I don't want to allow a website to link my identity to my email address or phone number. I don't want the website to push me messages. I am capable of storing passwords, so no need to send me password recovery emails. Email verification should be optional.

> I am capable of storing passwords, so no need to send me password recovery emails.

Maybe you are, maybe you aren't. As the website's operator, I don't want to manually have to go back-and-forth with everyone who forgets their password to try and verify their identity through their past activity etc.

Making it optional for the people who won't forget is fine, there's no way to know who that will be though. And if your password manager fail you'll be here on HN pointing out how I made a website with not a single fallback mechanism to get back in your account. Why would anyone do that?

Re: Why don’t we do email verification in reverse?

#243

Post by rvba » Sun, Aug 21, 2022, 2:11 PM UTC

amelius wrote: post #188

rvba wrote: post #181

Earlier quoted context omitted.

One person making multiple accounts to abuse the service. For example by spamming it.

Professional spammers probably would know how to set up fake email addresses.

You underestimate the number of people who are bad and technically incompetent.

Such basic things can stop a lot of idiots.

I guess you still lock your house even if proffessioanal thieves can pick your locks. 99% of thieves are not proffessional.

Re: Why don’t we do email verification in reverse?

#244

Post by remram » Sun, Aug 21, 2022, 2:12 PM UTC

ique wrote: post #166

There are essentially no applications that require email. We should just stop doing email verification altogether. If you need to have a separate communication channel with your user just establish that separately after signup.

Password resets. People forget their passwords all the time, and you don't want to deal with support emails and explain that they should have set an email in their security settings, so now they can't get back their their Twitter/Discord/Facebook account and there's nothing you can do (or will do).

Re: Why don’t we do email verification in reverse?

#245

Post by remram » Sun, Aug 21, 2022, 2:13 PM UTC

sagebird wrote: post #163

Another way to authenticate email is to provide your email address and password. This has the advantage that you do not need to receive or send an email. There may be downsides as well, but I cannot think of any ;-)

Or use OpenID Connect.

Re: Why don’t we do email verification in reverse?

#246

Post by nmz » Sun, Aug 21, 2022, 2:17 PM UTC

klabb3 wrote: post #204

mgarciaisaia wrote: post #20

Earlier quoted context omitted.

I'd argue the crux is about proving that Me The Service can send You The User whatever info is needed (password reset, notification of planned downtimes, pricing changes, warnings about service abuse) to this address - and you'll get it. I don't care about you "controlling" an email address - you can easily get fake ones for free. It's about both parties having agreed _at least once_ on a way for the service to commu…

> It's about both parties having agreed _at least once_ on a way for the service to communicate important stuff to you. Exactly. And the most important thing is password reset, because users forgetting passwords is the one true constant in the universe. Even if I'm not planning to spam you with newsletter crap, I'm still going to ask for your email just for this reason, otherwise I will get inf support tickets about…

With this method, it seems to me the entire user registration information would be in your Sent folder. So forgetting the password should be more difficult. Though you would still need to reset a password.

Re: Why don’t we do email verification in reverse?

#247

Post by bee_rider » Sun, Aug 21, 2022, 2:22 PM UTC

arinlen wrote: post #200

maccard wrote: post #182

Earlier quoted context omitted.

Thats a crazy level of risk assessment for an average user. > how does your password manager help you if your email password gets leaked? You still need my TOTP codes in my case at least, which conveniently are stored in my password manager. Is it perfectly secure? No, of course it's not, but frankly my risk profile isn't worrying about a targeted attack on me and my password manager, it's worrying about leaked share…

> Thats a crazy level of risk assessment for an average user. It really isn't. Think about it for a second: how hard is it to spot phishing attempts when they are sent to an email address you know for a fact you're not using with a service? And how vulnerable are you to phishing if your special-purpose email address that you only use for one specific purpose receives zero spam? To claim that the most basic and easy i…

In 2022 nobody actually clicks links in emails, right?

Re: Why don’t we do email verification in reverse?

#248

Post by wootest » Sun, Aug 21, 2022, 2:31 PM UTC

Ignoring every other benefit and concern, verification in the way proposed is a bad idea because part of the verification process in most cases is verifying that the service can send messages to you that actually get delivered. If you do this and then send the first "log in link" email which gets held up as spam or putatively malicious since some server has the temerity to not be located inside the US, doesn't have a DKIM signature, etc, you haven't really verified everything that you need to know. Of course, those things can change at the drop of a hat anyway, but I'd rather have verified that 1 time than 0 times.

If all you do is use it for login and will never need to send a message, then fair enough, the email is just essentially a random string you can prove ownership of, and your ability to send messages that will be delivered to the corresponding mailbox is incidental. But that's not a general enough conclusion to hold for why "we" (all cases) should do it that way.

Re: Why don’t we do email verification in reverse?

#249

Post by speedgoose » Sun, Aug 21, 2022, 2:38 PM UTC

ipaddr wrote: post #227

speedgoose wrote: post #107

Earlier quoted context omitted.

It’s still better than using the same few passwords everywhere or having a system with the site name. Because you need only on website vulnerability, which is quite common, to compromise your passwords. It’s better to have a single unlikely point of failure than many guaranteed points of failure in my opinion. Chrome has a password manager but the key is stored for you, which is less secure because it’s not using a H…

Your single point will be compromised. Someone gets access to your system they now have access to all of your passwords. Your password manager is hacked. Your device dies. Putting your eggs in one basket feels like a smart thing until you lose that basket.

I agree it’s not perfect but what is your better solution? My email and some passwords have been collected at least 8 times according to https://haveibeenpwned.com/

A password manager with multiple factor authentication sounds better to me.

Re: Why don’t we do email verification in reverse?

#250

Post by nickjj » Sun, Aug 21, 2022, 2:44 PM UTC

remram wrote: post #233

nickjj wrote: post #224

Earlier quoted context omitted.

> With magic links it happens every single login. Confirmation email only needs to be done once per email. I thought this was obvious? You don't have to do it on every single login. Check my previous reply's comment: > I really don't understand why so many folks hate magic links. They solve a number of problems in a pretty reasonable way at the cost of having to wait 5 seconds for 1 email to verify your email at whic…

"Logging in" typically refers to the situation where you don't have the cookie and need to get it. Having the cookie is typically referred to as "being logged in" already.

> "Logging in" typically refers to the situation where you don't have the cookie and need to get it.

Right, and after you click the link in your email to login then your back-end will set a cookie so that when you close your browser and come back again you will be logged in without needing to receive another link your email for however long you want "remember me" to be available.

The person I was replying to said the difference with magic links is you need to check your email every time you login. Especially with his "obvious" remark, it made it seem like he didn't realize you could use magic links and only login once a year just like you could use a password and only login once a year thanks to cookies working the same with both methods.